A fault handling system applied to safety instrumented systems

Abstract

This invention relates to a fault handling system applied in a safety instrumented system, comprising: a watchdog timer for receiving a feed signal and outputting a reset signal; a CPLD logic unit for storing a reset type identifier; DDR memory for representing characteristic data for detecting whether memory is lost during power-up; and an MCU processor connected to the watchdog timer, the CPLD logic unit, the DDR memory, and the MRAM memory, wherein the MCU memory is used to enter a hot reset mode when it is determined that the reset type identifier stored in the CPLD logic unit is a hot reset identifier. The hot reset mode is a mode implemented based on the watchdog timer reset signal, the reset type identifier stored in the CPLD logic unit, and the characteristic data stored in the DDR memory. Therefore, compared to existing schemes that repeatedly load programs, the hot reset-based diagnostic method of this application does not require repeated program loading, can quickly complete the diagnostic, meets the stringent requirements of safety instrumented systems for fault response time, and improves system safety.

Description

Technical Field

[0001] This invention relates to the field of safety instrumented systems technology, and more particularly to a fault handling system applied to safety instrumented systems. Background Technology

[0002] A safety instrumented system (SAS) is a widely used safety control system in industries such as petrochemicals and chemicals, primarily for alarm and shutdown control. When abnormal operating conditions occur during normal production, the SIS activates alarms or shutdown procedures to prevent further deterioration and ensure the safety of personnel and equipment.

[0003] Furthermore, the international standard IEC 61508 requires that microcontrollers used in safety instrumented systems meet hardware safety integrity requirements to control internal failures of the microcontroller and prevent the controlled equipment from entering hazardous conditions. Microcontroller diagnostics mainly include I / O, bus, CPU, registers, memory, clock, and instruction set diagnostics. For these faults, the safety instrumented system must be guided to a safe state within the fault response time. However, the fault response time of individual components is typically very short, generally 0.5–2 seconds, leaving insufficient time for multiple fault diagnosis confirmations. This can easily lead to misdiagnosis due to interference, causing the system to enter a safe state and affecting its availability. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a fault handling system applied to a safety instrumented system, which can improve the safety of the system.

[0006] (II) Technical Solution

[0007] To achieve the above objectives, the main technical solutions adopted by the present invention include:

[0008] This invention provides a fault handling system applied to a safety instrumented system, comprising: a watchdog timer for receiving a feed signal and outputting a reset signal; a CPLD logic unit for storing a reset type identifier; DDR memory for representing characteristic data for detecting whether memory is lost during power-up; and an MCU processor connected to the watchdog timer, the CPLD logic unit, the DDR memory, and the MRAM memory, wherein the MCU memory is used to enter a hot reset mode when it is determined that the reset type identifier stored in the CPLD logic unit is a hot reset identifier; wherein the hot reset mode is a mode implemented based on the watchdog timer reset signal, the reset type identifier stored in the CPLD logic unit, and the characteristic data stored in the DDR memory.

[0009] In one possible embodiment, the watchdog time window ranges from 0.7s to 1.3s.

[0010] In one possible embodiment, the reset type is identified as a cold reset identifier, a hot reset identifier, or an abnormal reset identifier.

[0011] In one possible embodiment, the cold reset flag is 0x0, the hot reset flag is 0x5A, and the abnormal reset flag is 0xFF or other values, where other values ​​are values ​​other than 0x0, 0x5A, and 0xFF.

[0012] In one possible embodiment, the MCU processor is specifically configured to send a watchdog feed signal to the watchdog and receive a reset signal returned by the watchdog during the power-on startup process, and, if it is determined that the reset type identifier stored in the CPLD logic unit is a hot reset identifier and the feature data stored in the DDR memory has not been lost, write an abnormal reset identifier to the CPLD logic unit and perform program execution operations at the same time.

[0013] In one possible embodiment, the MCU processor is specifically configured to, upon determining that the reset type identifier stored in the CPLD logic unit is a cold reset identifier, load and execute a program, initialize program data, write an abnormal reset identifier to the CPLD logic unit, and simultaneously perform program execution operations.

[0014] In one possible embodiment, the MCU processor is specifically configured to, when determining that the reset type identifier stored in the CPLD logic unit is not a hot reset identifier, determine whether the reset type identifier stored in the CPLD logic unit is a cold reset identifier; if it is a cold reset identifier, load the execution program, initialize the program data, write an abnormal reset identifier to the CPLD logic unit, and perform program execution operations simultaneously.

[0015] In one possible embodiment, the fault handling system further includes an MRAM memory for storing the number of abnormal resets;

[0016] The MCU processor is specifically used to read the number of abnormal resets stored in the MRAM memory when it is determined that the reset type identifier stored in the CPLD logic unit is not a cold reset identifier, and to determine whether the number of abnormal resets exceeds a preset number. If the number of abnormal resets exceeds the preset number, it enters a fault-safe state.

[0017] (III) Beneficial Effects

[0018] The beneficial effects of this invention are:

[0019] This invention proposes a fault handling system for a safety instrumented system, including a watchdog timer, a CPLD logic unit, DDR memory, and an MCU processor. The MCU memory is used to enter a hot reset mode when the reset type identifier stored in the CPLD logic unit is determined to be a hot reset identifier. This hot reset mode is based on the watchdog timer's reset signal, the reset type identifier stored in the CPLD logic unit, and the feature data stored in the DDR memory. Compared to existing solutions that repeatedly load programs, this application's hot reset-based diagnostics eliminates the need for repeated program loading (this part is usually the most time-consuming part of MCU startup), enabling rapid diagnostics and meeting the stringent requirements of safety instrumented systems for fault response time, thus improving system safety.

[0020] To make the above-mentioned objectives, features and advantages to be achieved by the embodiments of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This illustration shows a schematic diagram of a fault handling system applied to a safety instrumented system according to an embodiment of this application;

[0023] Figure 2 A flowchart of a thermal reset method provided in an embodiment of this application is shown;

[0024] Figure 3 A flowchart of an abnormal reset method provided in an embodiment of this application is shown. Detailed Implementation

[0025] To better explain and facilitate understanding of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] This invention proposes a fault handling system for a safety instrumented system, including a watchdog timer, a CPLD logic unit, DDR memory, and an MCU processor. The MCU memory is used to enter a hot reset mode when the reset type identifier stored in the CPLD logic unit is determined to be a hot reset identifier. This hot reset mode is based on the watchdog timer's reset signal, the reset type identifier stored in the CPLD logic unit, and the feature data stored in the DDR memory. Compared to existing solutions that repeatedly load programs, this application's hot reset-based diagnostics eliminates the need for repeated program loading (this part is usually the most time-consuming part of MCU startup), enabling rapid diagnostics and meeting the stringent requirements of safety instrumented systems for fault response time, thus improving system safety.

[0027] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0028] Please see Figure 1 , Figure 1 A schematic diagram of a fault handling system applied in a safety instrumented system according to an embodiment of this application is shown. Specifically, the fault handling system includes:

[0029] A watchdog timer, also known as a time-window watchdog, has a time window (or watch window) ranging from 0.7s to 1.3s. If the MCU processor sends a feed signal to the watchdog outside the watch window time, the watchdog will send a reset signal Rst to the MCU, triggering the MCU processor to reset.

[0030] The CPLD logic unit stores the MCU reset type identifier. For a cold reset, the reset identifier is 0x0; for a hot reset, it is 0x5A; and for an abnormal reset, it is 0xFF or another value, where "other values" are values ​​other than 0x0, 0x5A, and 0xFF. Here, a hot reset indicates a reset operation initiated by the MCU, while an abnormal reset indicates a reset operation not initiated by the MCU due to a program fault or other abnormality.

[0031] It should be noted that the reset type is identified as a cold reset, a hot reset, or an abnormal reset.

[0032] It should be understood that although the cold reset indicator, hot reset indicator, and abnormal reset indicator have been described above, those skilled in the art should understand that they can be adjusted to other indicators.

[0033] DDR memory is used to store execution data during MCU processor operation, and it also stores a segment of characteristic data used to detect whether the memory has been lost during power-up. For example, this characteristic data is 0x1234xxxx, with a data length of 4kB, and is used to check whether the memory has been lost upon power-up.

[0034] MRAM memory is used to store the number of abnormal resets;

[0035] The MCU processor is connected to the watchdog timer, CPLD logic unit, DDR memory, and MRAM memory.

[0036] exist Figure 1 Based on the fault handling system shown, please refer to Figure 2 , Figure 2 A flowchart of a thermal reset method provided in an embodiment of this application is shown. Specifically, the thermal reset method includes:

[0037] In step S201, the MCU processor writes a normal hot reset flag 0x5A to the CPLD logic unit and writes a segment of characteristic data to the DDR memory.

[0038] In step S202, during the power-on startup process, the MCU processor continuously sends two watchdog feed signals to the watchdog, causing the watchdog to feed back a reset signal Rst to the MCU processor, so that the MCU can start a hot reset.

[0039] Step S203: After the MCU processor undergoes a hot reset, the MCU processor reads the CPLD reset flag and determines whether the CPLD reset flag is 0x5A. If the flag is 0x5A, proceed to step S204; otherwise, proceed to step S207.

[0040] In step S204, the MCU processor determines whether the feature data stored in the DDR memory has been lost. If not, proceed to step S205;

[0041] In step S205, the MCU processor writes the feature value 0xFF to the CPLD logic unit and directly executes the program;

[0042] Step S206, End;

[0043] In step S206, the MCU processor continues to determine whether the CPLD flag is 0x0. If the CPLD flag is 0x0, then proceed to step S207. If the CPLD flag is not 0x0, then proceed to step S208.

[0044] In step S207, the MCU processor loads the execution program, initializes the program data, and executes step S205.

[0045] Step S208: The MCU processor enters abnormal reset mode, as detailed below. Figure 3 The relevant procedures.

[0046] And, in the introduction Figure 3 Before discussing the relevant content, the fault confirmation process for this application is described below:

[0047] The counter can be designed with three parameters N, X, and Y, where N represents the current fault count; X represents the value by which the counter increases or decreases when a single fault occurs and is cleared; and Y represents the upper limit of the fault counter.

[0048] Furthermore, if a fault is detected, the fault count N = N + X; if Y ≤ N, the fault is confirmed.

[0049] If fault recovery is detected, the fault count N = NX; if N ≤ 0, then fault recovery is determined.

[0050] A fault was detected during the fault recovery process, N=Y.

[0051] Based on the above counter design, please refer to Figure 3 , Figure 3 A flowchart of an abnormal reset method provided in an embodiment of this application is shown. Specifically, the abnormal reset method includes:

[0052] Step S301: The MCU processor reads the number of abnormal resets from the MRAM memory;

[0053] In step S302, the MCU processor determines whether the number of abnormal resets exceeds the preset number; the specific number of the preset number can be set according to actual needs.

[0054] If the preset number of attempts has not been exceeded, proceed to step S303; if the preset number of attempts has been exceeded, proceed to step S304.

[0055] In step S303, the MCU processor increments the number of abnormal resets in the MRAM memory by 1, loads and executes the program, initializes the program data, and runs normally.

[0056] Step S304: The MCU enters fail-safe mode;

[0057] Step S305, End.

[0058] Furthermore, to facilitate understanding of the specific process of the abnormal reset method, the following description uses instruction set errors as an example.

[0059] Specifically, when the MCU processor diagnoses an instruction execution error, it increments the fault counter N by 1. If the same diagnosis is performed at this time, the same result will be obtained, and the MCU needs to be hot-reset. After the hot reset, instruction diagnosis is performed. If the diagnosis is incorrect, the fault counter N is incremented by 1. The diagnosis operation is repeated. When N is greater than or equal to the preset number of times, the fault is confirmed and the module enters fault-safe processing. When N is less than or equal to 0, no fault is confirmed and the module continues to operate normally.

[0060] Therefore, by means of the above technical solution, the diagnostic method based on hot reset in this application does not require repeated loading of the program, and can quickly complete the diagnosis, meeting the stringent requirements of safety instrumented systems for fault response time and improving the safety of the system.

[0061] Furthermore, compared to the existing method of directly performing multiple instruction diagnostics, the hot reset of this application can initialize the state of the MCU, thereby preventing misdiagnosis caused by random faults and improving the availability of the system.

[0062] In addition, this method can also diagnose abnormal module resets caused by program errors or other reasons, preventing system malfunctions due to resets.

[0063] It should be understood that the fault handling system applied to the safety instrumented system described above is merely exemplary. Those skilled in the art can make various modifications to the fault handling system according to actual needs, and such modified solutions also fall within the protection scope of this application.

[0064] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0066] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0067] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0068] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0069] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A fault handling system applied to a safety instrumented system, characterized in that, include: A watchdog timer is used to receive a dog-feeding signal and output a reset signal. A CPLD logic unit is used to store a reset type identifier; the reset type identifier is a cold reset identifier, a hot reset identifier, or an abnormal reset identifier. DDR memory is used to represent characteristic data used to detect whether memory is lost during power-on. The MCU processor is connected to the watchdog timer, the CPLD logic unit, the DDR memory, and the MRAM memory. The MCU processor is used to enter a hot reset mode when it determines that the reset type identifier stored in the CPLD logic unit is the hot reset identifier. The hot reset mode is a mode implemented based on the watchdog timer reset signal, the reset type identifier stored in the CPLD logic unit, and the feature data stored in the DDR memory. The MCU processor is specifically used to send a dog-feeding signal to the watchdog and receive a reset signal returned by the watchdog during the power-on startup process. If it is determined that the reset type identifier stored in the CPLD logic unit is the hot reset identifier and the feature data stored in the DDR memory has not been lost, the processor writes the abnormal reset identifier to the CPLD logic unit and performs program execution operations. Specifically, the MCU processor is used to load and execute a program, initialize program data, write the abnormal reset flag to the CPLD logic unit, and perform program execution operations when it is determined that the reset type flag stored in the CPLD logic unit is the cold reset flag. The MCU processor is specifically configured to, when determining that the reset type identifier stored in the CPLD logic unit is not the hot reset identifier, determine whether the reset type identifier stored in the CPLD logic unit is the cold reset identifier; if it is the cold reset identifier, load and execute the program, initialize the program data, write the abnormal reset identifier to the CPLD logic unit, and perform program execution operations simultaneously. The fault handling system further includes an MRAM memory for storing the number of abnormal resets; Specifically, the MCU processor is used to read the number of abnormal resets stored in the MRAM memory when it is determined that the reset type identifier stored in the CPLD logic unit is not the cold reset identifier, and to determine whether the number of abnormal resets exceeds a preset number. If the number of abnormal resets exceeds the preset number, it enters a fault-safe state.

2. The fault handling system according to claim 1, characterized in that, The time window of the watchdog timer ranges from 0.7s to 1.3s.

3. The fault handling system according to claim 1, characterized in that, The cold reset identifier is 0x0, the hot reset identifier is 0x5A, and the abnormal reset identifier is 0xFF or other values, wherein the other values ​​are values ​​other than 0x0, 0x5A, and 0xFF.

Images